Dealing with False Positive Alerts SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A SOC analyst is triaging an alert that indicates a user account was used to log in from two different countries within 30 minutes. The analyst checks the user's travel history and finds that the user is on a business trip and has a connecting flight that could explain the two locations. The analyst also checks the VPN logs and sees that the user connected through a VPN endpoint in the second country. How should the analyst classify this alert?

   • ATrue positive because the logins occurred from two different countries.
   • BTrue negative because the alert was generated but no malicious activity occurred.
   • CFalse positive because the activity is explained by the user's travel and VPN usage.
   • DFalse negative because the alert should have been suppressed.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC team notices that a specific detection rule generates a high number of false positives after a recent network infrastructure change. The rule was designed to detect lateral movement by flagging connections to administrative shares (e.g., ADMIN$). After the change, a legitimate backup system now connects to administrative shares on all servers. The team wants to reduce false positives while maintaining detection of lateral movement. Which action is most appropriate?

   • AIncrease the alert threshold to require more than one connection to an administrative share.
   • BChange the rule to alert on all connections to administrative shares regardless of source.
   • CDisable the rule because the backup system is legitimate.
   • DAdd an exception for the backup system's service account or source IP.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In security monitoring, which definition best describes a false positive alert?

   • AAn alert triggered by a legitimate activity that is incorrectly flagged as malicious
   • BAn alert that fails to fire when a real attack occurs
   • CAn alert that correctly identifies a real attack but is ignored by the analyst
   • DAn alert generated by a test that is intentionally triggered to verify detection coverage
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the most effective way to use feedback from false positive investigations to improve detection mechanisms?

   • AProvide detailed findings to the detection engineering team so they can adjust rules and signatures
   • BDelete the false positive alerts from the SIEM to keep the console clean
   • CIgnore false positives because they are not real threats
   • DIncrease the severity of false positive alerts to ensure they are reviewed
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a primary operational impact of a high volume of false positive alerts on a security operations center (SOC)?

   • AThe organization's security posture improves because more alerts are investigated
   • BAnalysts become desensitized to alerts and may overlook a genuine threat
   • CThe SOC's incident response plan becomes more efficient because analysts get more practice
   • DThe SIEM automatically suppresses all alerts, including true positives
   Reveal Solution Discussion Select an answer first